Which term describes the formal process of evaluating potential losses and prioritizing resources to mitigate risk in an organization?

• A. Risk management
• B. Business Impact Analysis (BIA)
• C. Incident response
• D. Disaster recovery planning

Answer: (B)

Business Impact Analysis focuses on evaluating potential losses and prioritizing resources to mitigate risk. It systematically identifies critical business functions, dependencies, and the impacts of interruptions, then defines recovery priorities and objectives (such as maximum tolerable outage and recovery time). This information guides where to allocate resources and what to protect first. It differs from risk management, which is the broader process of identifying and treating risks; incident response, which handles ongoing security events; and disaster recovery planning, which documents how to restore IT systems after a disruption.